Danish security experts are calling for the 58-year-old CPR system to be redesigned or scrapped after unauthorized access to data on about 8.8 million people. Digitalisation Minister Christina Egelund has ordered a full security review of the register.
According to reporting by DR, several specialists are now urging the government to rethink or abolish the CPR system entirely. Jan Kaastrup, a digital investigator at the cybersecurity company CSIS, told the broadcaster that the register has not kept pace with Danish digitalization. He compared it to a horse-drawn carriage while others drive a Porsche.
The renewed criticism follows the breach announced this week. The Copenhagen Post reports that unauthorized parties accessed names, addresses and CPR numbers belonging to roughly 8.8 million people. The access was gained by misusing a private company’s lawful access to the register.
How the breach was discovered
The CPR administration detected irregular activity on October 2, 2026, according to The Copenhagen Post. The unauthorized access itself had taken place during September. The register covers everyone who has ever been assigned a CPR number, which is why the figure exceeds Denmark’s population.
Kaastrup points to what he sees as a structural flaw. A CPR number cannot be replaced if it leaks, which he likens to having a single password for life that works across a large number of systems. He also told DR that he has only slightly more than 200 possible numbers, meaning his own can effectively be guessed.
Why experts say CPR numbers are not proof of identity
The Danish Council for Digital Security, Rådet for Digital Sikkerhed, has made the same argument for years. Chairman Henning Mortensen told DR that the number was intended as a record number, not as a means of authentication. Proving identity, he said, should rely on a passport, a driver’s license or MitID.
Mortensen wants gender, birth year and birth date stripped out of the number. He suggested an anonymous CPR number that could even be published openly, making clear to everyone that it cannot function as a key. He added that he has been frustrated after each breach, and hopes the warnings are heard this time.
As DR notes, this is not the first alarm. The same debate ran in 2013, when the Council made near-identical arguments. The then economy and interior minister, Margrethe Vestager of Radikale Venstre, said Denmark would miss the CPR system if it were discarded.
Minister orders a security assessment
Egelund, of Moderaterne, would not promise that the CPR system will be scrapped. She described it to DR as a fundamental building block of Denmark’s digital infrastructure. She also said a serious incident should prompt difficult questions about whether the setup should be arranged in a completely different way.
The minister has requested a thorough security assessment of how the CPR register operates. The Copenhagen Post reported on October 6 that Denmark considers it too early to decide whether people affected by the breach need new CPR numbers.
What the CPR breach means for foreign residents
The CPR number is assigned when a person registers a Danish address, and it follows them permanently. It is used for the yellow health card, tax records, bank onboarding, borger.dk logins and employment records. Internationals who arrive later in life often have fewer possible number combinations tied to their registration date, the kind of predictability Kaastrup described.
For now, no change to the system has been decided, and no decision has been made on issuing replacement numbers. MitID remains the authentication tool that the Council for Digital Security points to as valid proof of identity, rather than the CPR number itself. Misuse of leaked numbers has been prosecuted before, including a case involving a former student accused of selling CPR numbers to criminals.
